{"id":"ALSA-2020:1766","summary":"Moderate: GNOME security, bug fix, and enhancement update","details":"GNOME is the default desktop environment of AlmaLinux.\n\nSecurity Fix(es):\n\n* LibRaw: stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (CVE-2018-20337)\n\n* gdm: lock screen bypass when timed login is enabled (CVE-2019-3825)\n\n* gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c (CVE-2019-12447)\n\n* gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write (CVE-2019-12448)\n\n* gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges (CVE-2019-12449)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","modified":"2026-11-05T12:15:06.903889404Z","published":"2020-04-28T09:13:23Z","related":["CVE-2018-20337","CVE-2019-12447","CVE-2019-12448","CVE-2019-12449","CVE-2019-3825"],"upstream":["CVE-2018-20337","CVE-2019-12447","CVE-2019-12448","CVE-2019-12449","CVE-2019-3825"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:1766"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1365717"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1656988"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1658001"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1661555"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1666070"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1668901"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1671744"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1672825"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1674535"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1684729"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1687979"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1690170"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1692299"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1710882"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1715890"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1716754"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1716761"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1716767"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1716774"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1719819"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1720249"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1720251"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1721124"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1721133"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1723462"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1723464"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1724302"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1725154"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1728330"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1728562"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1728564"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1728567"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1730612"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1730891"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1736742"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1742710"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1744452"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1744527"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1745147"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1747972"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1749372"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1750516"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1753520"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1759075"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1759525"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1759619"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1759913"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1760363"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1763207"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1765448"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1765632"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1766649"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1766695"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1768461"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1776530"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1777556"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1777911"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1778668"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1782425"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1782497"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1782517"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1785233"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1789474"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1793413"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1804123"},{"type":"REPORT","url":"https://bugzilla.redhat.com/1809079"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2020-1766.html"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2018-20337"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2019-12447"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2019-12448"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2019-12449"},{"type":"REPORT","url":"https://vulners.com/cve/CVE-2019-3825"}],"affected":[{"package":{"name":"accountsservice-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/accountsservice-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.50-8.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"baobab","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/baobab"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-4.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"clutter","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/clutter"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-8.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"clutter-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/clutter-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-8.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"clutter-doc","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/clutter-doc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-8.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"gjs-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/gjs-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56.2-4.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"gnome-menus","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/gnome-menus"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3-11.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"gnome-menus-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/gnome-menus-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.3-11.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"gnome-tweaks","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/gnome-tweaks"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.1-7.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs52","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs52"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.0-2.el8.alma"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs52","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs52"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.0-2.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs52-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs52-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.0-2.el8.alma"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs52-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs52-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.0-2.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs60","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs60"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-4.el8.alma"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs60","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs60"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-4.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs60-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs60-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-4.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"mozjs60-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/mozjs60-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-4.el8.alma"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"vala","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/vala"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.19-1.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}},{"package":{"name":"vala-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/vala-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.19-1.el8"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2020:1766.json"}}],"schema_version":"1.9.2"}